How to discover hidden SSIDs ? I know there are tool like WiGLE WiFi (Mobile) which can identify hidden SSID. How those tools are exactly working. How it is discovering hidden SSID WiFi beacons ?


Basically you just need to force a user on that network to disassociate with the wifi, then when it reconnects, the ssid will be transmitted in plain text.

Check out this guide.


  • 1
    Deauth attacks will not work all the time, but this is the right way to probe SSIDs. – user28177 Jan 13 '17 at 9:49

The baics of wifi (802.11 IEEE standard) states that there are 3 connection stages.

  1. Not authenticated or associated
  2. Authenticated but not yet associated
  3. Authenticated and associated

To move from the 1st stage to the 2nd, the STA (Station, any device/supplicant) sends a probe request with an SSID that is has saved in it's lists of already connected wireless networks, it is this exact packet that we want to capture.

To find a network name of a hidden ssid you need to send a STA from the 3rd stage of connection to the very first, to capture the probe request and read the SSID it's trying to connect.

This is done sending a disassociation management package to the AP spoofing the STA, and then sniffing the probe request when it wants to connect again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.